DHIS2 vulnerabilities
3 known CVE vulnerabilities in DHIS2, translated and rated.
- CVE-2026-55084High
DHIS2 (versions 2.37-2.44) contains a SQL injection vulnerability in the SqlView API endpoint. An authenticated user with SqlView access can inject arbitrary SQL queries via the filter parameter by abusing a PostgreSQL expression, with output reflected in error messages.
- CVE-2026-55082High
Vulnerability in DHIS2 SQL View data endpoints. Authenticated users with SQL View access can provide crafted filter values that are interpolated into generated SQL, potentially accessing data outside the intended result set.
- CVE-2026-55081High
XSS vulnerability in DHIS2 versions 2.42 and 2.43 before the 2026-06-09 security patches, and in the 2.44 development branch. An attacker can inject active HTML or JavaScript via the scope parameter in the OpenAPI HTML endpoint.